Smart intrusion prevention policy

ABSTRACT

A data packet is received. The data packet is a unit of data transmitted across a packet-switched network. A determination is made whether a new connection is detected. The data packet is transmitted using the new connection. In response to determining that a new connection is detected, a connection context for the new connection is added to a current connection context in a dynamic event table. The dynamic event table includes the current connection context, one or more previous connection contexts, and a listing of one or more events. Each event of the one or more events is a malicious activity and is retrieved from a repository. A score for each event is calculated based on the current connection context. Each event in the dynamic event table is prioritized based on the calculated score for each event. The event with the highest score receives the highest priority.

BACKGROUND

The present invention relates generally to the field of intrusionprevention, and more particularly to prioritizing intrusion events.

Intrusion prevention systems (IPS) are network security appliances thatmonitor network and/or system activities for malicious activity. Themain functions of intrusion prevention systems are to identify maliciousactivity, log information about this malicious activity, attempt toblock/stop the malicious activity, and report the malicious activity.Intrusion prevention systems are considered extensions of intrusiondetection systems because they both monitor network traffic and/orsystem activities for malicious activity. The main differences are,unlike intrusion detection systems, intrusion prevention systems areplaced in-line and are able to prevent/block intrusions, in real time,that are detected. More specifically, the IPS can take such actions assending an alarm, dropping the malicious packets, resetting theconnection and/or blocking the traffic from the offending IP (Internetprotocol) address. An IPS can also correct Cyclic Redundancy Check (CRC)errors, unfragment packet streams, prevent transmission control protocol(TCP) sequencing issues, and clean up unwanted transport and networklayer options.

SUMMARY OF THE INVENTION

Embodiments of the present invention include a method, computer programproduct, and system for prioritizing intrusion events. In oneembodiment, a data packet is received. The data packet is a unit of datatransmitted across a packet-switched network. A determination is madewhether a new connection is detected. The data packet is transmittedusing the new connection. In response to determining that a newconnection is detected, a connection context for the new connection isadded to a current connection context in a dynamic event table. Thedynamic event table includes the current connection context, one or moreprevious connection contexts, and a listing of one or more events. Eachevent of the one or more events is a malicious activity. Each event ofthe one or more events is retrieved from a repository. A score for eachevent of the one or more events in the dynamic event table is calculatedbased on the current connection context. Each event of the one or moreevents in the dynamic event table is prioritized based on the calculatedscore for each event of the one or more events. The event with thehighest score receives the highest priority.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts a functional block diagram of a computing environment, inaccordance with an embodiment of the present invention;

FIG. 2 depicts a flowchart of a program for prioritizing intrusionevents, in accordance with an embodiment of the present invention;

FIG. 3A, FIG. 3B, and FIG. 3C are example dynamic event tables, inaccordance with an embodiment of the present invention; and

FIG. 4 depicts a block diagram of components of the computingenvironment of FIG. 1, in accordance with an embodiment of the presentinvention.

DETAILED DESCRIPTION

Embodiments of the present invention provide for prioritizing intrusionevents. Methods used by current intrusion prevention systems (IPS) forfinding malicious activity may use a real-time signature matchingprocess which may become a latency bottleneck due to the high number ofrules. In addition, IPS administrators may have a complex issueattempting to customize and optimize the high number of rules to suitthe specific requirements of the administrator. It is not an efficientpractice to enable all of the available rules for the IPS and doing somay result in a performance impact to the network.

Embodiments of the present invention recognize that there may be amethod, computer program product, and computer system for prioritizingintrusion events in a signature-based intrusion preventions system. Themethod, computer program product, and computer system may enhance theefficiency of signature matching by dynamically prioritizing each IPSevent throughout the connection based on the connection contextinformation determined from the incoming data packets. Signaturematching will be focused on events with a higher priority while lesstime will be spent on signature matching for events with a lowerpriority.

The present invention will now be described in detail with reference tothe Figures.

FIG. 1 is a functional block diagram illustrating a computingenvironment, generally designated 100, in accordance with one embodimentof the present invention. FIG. 1 provides only an illustration of oneimplementation and does not imply any limitations with regard to thesystems and environments in which different embodiments may beimplemented. Many modifications to the depicted embodiment may be madeby those skilled in the art without departing from the scope of theinvention as recited by the claims.

In an embodiment, computing environment 100 includes device 120 andclient device 130 connected to network 110. In example embodiments,computing environment 100 may include other computing devices (notshown) such as smartwatches, cell phones, smartphones, wearabletechnology, phablets, tablet computers, laptop computers, desktopcomputers, other computer servers or any other computer system known inthe art, interconnected with device 120 and client device 130 overnetwork 110.

In example embodiments, device 120 and client device 130 may connect tonetwork 110, which enables device 120 to access other computing devicesand/or data not directly stored on device 120 and client device 130.Network 110 may be, for example, a local area network (LAN), atelecommunications network, a wide area network (WAN) such as theInternet, or any combination of the three, and include wired, wireless,or fiber optic connections. Network 110 may include one or more wiredand/or wireless networks that are capable of receiving and transmittingdata, voice, and/or video signals, including multimedia signals thatinclude voice, data, and video information. In general, network 110 canbe any combination of connections and protocols that will supportcommunications between device 120, client device 130, and any othercomputing devices connected to network 110, in accordance withembodiments of the present invention. In an embodiment, data received byanother computing device in computing environment 100 (not shown) may becommunicated to device 120 and client device 130 via network 110.

In embodiments of the present invention, device 120 may be a laptop,tablet, or netbook personal computer (PC), a desktop computer, apersonal digital assistant (PDA), a smartphone, a standard cell phone, asmart-watch or any other wearable technology, or any other hand-held,programmable electronic device capable of communicating with any othercomputing device within computing environment 100. In certainembodiments, device 120 represents a computer system utilizing clusteredcomputers and components (e.g., database server computers, applicationserver computers, etc.) that act as a single pool of seamless resourceswhen accessed by elements of computing environment 100. In general,device 120 is representative of any electronic device or combination ofelectronic devices capable of executing computer readable programinstructions. Client device 130 is substantially similar to device 120.Computing environment 100 may include any number of device 120 andclient device 130. Device 120 and client device 130 may includecomponents as depicted and described in further detail with respect toFIG. 4, in accordance with embodiments of the present invention.

In an embodiment, client device 130 includes repository 132, intrusionprevention system (IPS) 134, and smart intrusion program 136. Accordingto embodiments of the present invention, repository 132 may be storagethat may be written to and/or read by smart intrusion program 136. Inone embodiment, repository 132 resides on client device 130. In anotherembodiment, repository 132 resides on device 120. In other embodiments,repository 132 may reside on any other device (not shown) in computingenvironment 100, in cloud storage or on another computing deviceaccessible via network 110. In yet another embodiment, repository 132may represent multiple storage devices within device 120 and/or clientdevice 130.

In an embodiment, repository 132 may be implemented using any volatileor non-volatile storage media for storing information, as known in theart. For example, repository 132 may be implemented with a tape library,optical library, one or more independent hard disk drives, multiple harddisk drives in a redundant array of independent disks (RAID),solid-state drives (SSD), or random-access memory (RAM). Similarly,repository 132 may be implemented with any suitable storage architectureknown in the art, such as a relational database, an object-orienteddatabase, or one or more tables. In an embodiment of the presentinvention, smart intrusion program 136 and any other programs andapplications (not shown) operating on device 120 may store, read,modify, or write data to repository 132. Examples of data stored torepository 132 include known IPS events including intrusion eventsignatures, IPS event scores, and IPS event actions. In an embodiment,an IPS event is an activity suspected or known to be malicious (i.e.,will harm the network or one or more computing devices connected to thenetwork). In an embodiment, IPS event actions include stopping theactivity from proceeding when the activity is deemed malicious (i.e.,finding matching signatures), discarding the activity (i.e., datapackets) when finding matching signatures, resetting the connectionand/or blocking the traffic from the offending IP (Internet protocol)address, and sending an alert when matching signatures are found,thereby deeming the activity malicious.

In an embodiment, IPS 134 is a network security appliance that monitorsnetwork and/or system activities for malicious activity. In anembodiment, IPS 134 is part of client device 130. In another embodiment,IPS 134 is a stand-alone device connected to network 110. According toembodiments of the present invention, the main functions of IPS 134 areto identify malicious activity, log information about this activity,attempt to block/stop it, and report it. In an embodiment, IPS 134 cantake such actions as sending an alarm, dropping the malicious packets,resetting the connection and/or blocking the traffic from the offendingIP address. In an embodiment, IPS 134 uses a signature-based detectionmethod for detecting malicious activity. Signature-based detectionmonitors packets in the network and compares the packets withpre-configured and pre-determined attack patterns known as signatures.In other embodiments, IPS 134 may use other detections method such asstatistical anomaly-based detection and stateful protocol analysisdetection.

According to embodiments of the present invention, smart intrusionprogram 136 may be a program, a subprogram of a larger program, anapplication, a plurality of applications, or mobile applicationsoftware, which functions to prioritize intrusion events (i.e., put theintrusion events into a prioritized order). A program is a sequence ofinstructions written by a programmer to perform a specific task. Smartintrusion program 136 may run by itself but may be dependent on systemsoftware (not shown) to execute. In one embodiment, smart intrusionprogram 136 functions as a stand-alone program residing on client device130. In another embodiment, smart intrusion program 136 may be includedas a part of device 120. In yet another embodiment, smart intrusionprogram 136 may be included as a part of IPS 134. In yet anotherembodiment, smart intrusion program 136 may work in conjunction withother programs, applications, etc., found on client device 130 or incomputing environment 100. In yet another embodiment, smart intrusionprogram 136 may be found on other computing devices (not shown) incomputing environment 100 which are interconnected to client device 130via network 110.

According to embodiments of the present invention, smart intrusionprogram 136 functions to prioritize intrusion events in asignature-based intrusion prevention system such as IPS 134. Accordingto an embodiment of the present invention, smart intrusion program 136monitors incoming packets of data as the packets move through a network,calculates a score for each IPS event, and prioritizes each IPS event.In an embodiment, smart intrusion program 136 monitors data packets sentby device 120 to client device 130 over network 110.

FIG. 2 is a flowchart of workflow 200 depicting a method forprioritizing intrusion events, in accordance with an embodiment of thepresent invention. In one embodiment, the method of workflow 200 isperformed by smart intrusion program 136. In an alternative embodiment,the method of workflow 200 may be performed by any other program workingwith smart intrusion program 136. In an embodiment, a user, via a userinterface (not shown), may invoke workflow 200 upon the user startingone or more applications on a computing device. In an alternativeembodiment, a user may invoke workflow 200 upon accessing smartintrusion program 136.

In an embodiment, smart intrusion program 136 receives a data packet(step 202). In other words, smart intrusion program 136 receives a datapacket, sent from a first computing device, before the packet isreceived by a second computing device. In an embodiment, a data packetis a unit of data that is transmitted across a packet-switched network.A packet-switched network is an interconnected set of networks that arejoined by routers or switching routers. The most common packet-switchingtechnology is the transmission control protocol/Internet protocol(TCP/IP), and the Internet is the largest packet-switched network. In anembodiment, the concept of a packet-switched network is that any hostconnecting to the network may send packets to any other hosts. Datapackets contain header (or control) information, which includes adestination address, and a payload (i.e., user data). Routers in thenetwork read the address in the header information and forward the datapackets along the most appropriate path to the destination IP address.In an embodiment, the TCP/IP connection is identified by a 5-tuple whichrefers to a set of five different values (source IP address, source portnumber, destination IP address, destination port number, and protocol)that comprise the TCP/IP connection. In an embodiment, smart intrusionprogram 136 receives a data packet, with a destination address of clientdevice 130, which was sent from device 120. For example, a user hasqueried a search engine on the Internet and a web server has sent aresponse to the computing device of the user.

In an embodiment, smart intrusion program 136 determines whether a newconnection is detected (decision step 204). In other words, smartintrusion program 136 determines whether a new connection is detectedand needs to be added to a dynamic event table. In an embodiment(decision step 204, YES branch), a new connection is detected;therefore, smart intrusion program 136 proceeds to step 206 to add thenew connection in a dynamic event table. In the embodiment (decisionstep 204, NO branch), a new connection is not detected; therefore, smartintrusion program 136 proceeds to step 208 to retrieve information aboutthe existing connection.

In an embodiment, smart intrusion program 136 adds a new connection(step 206). In other words, responsive to determining that a newconnection is detected (decision step 204, YES branch), smart intrusionprogram 136 either creates a new dynamic event table for a connectioncontext (and adds the connection context to the new dynamic event table)or adds a connection context to an existing dynamic event table for thedetected connection. In an embodiment, the connection context is thetype of connection established between two computing devices. In anembodiment, the dynamic event table includes the current connectioncontext for an established connection, previous connection contexts, anda listing of prioritized IPS events. In an embodiment, the listing ofprioritized IPS events is based on the current connection context. In anembodiment, each IPS event is given a score and the score is used todetermine the priority of the IPS events. In an embodiment, each IPSevent for the initial connection context in the dynamic event table isgiven the same score. In the embodiment, the score for each IPS eventwill increase, decrease, or remain the same based on the relationship ofthe IPS event to a connection context. In an embodiment, smart intrusionprogram 136 adds a connection context to a dynamic event table stored torepository 132 in client device 130. For example, as depicted in FIG. 3Aof dynamic event table 300, a TCP (transmission control protocol)connection context is added to the dynamic event table.

In an embodiment, smart intrusion program 136 retrieves connectioninformation (step 208). In other words, responsive to determining that anew connection is not detected (decision step 204, NO branch), smartintrusion program 136 retrieves the current connection contextinformation from a dynamic event table. In an embodiment, smartintrusion program 136 retrieves the current connection contextinformation from a dynamic event table stored to repository 132 onclient device 130. For example, as depicted in FIG. 3A of dynamic eventtable 300, the information retrieved is that the current connectioncontext is a TCP connection.

In an embodiment, smart intrusion program 136 determines whether theconnection context is new (decision step 210). In other words, smartintrusion program 136 determines whether the current connection includesa new context. In one embodiment (decision step 210, YES branch), thecontext of the connection is new; therefore, smart intrusion program 136proceeds to step 212 to update the connection context in the dynamicevent table. In the embodiment (decision step 210, NO branch), thecontext of the connection is not new; therefore, smart intrusion program136 proceeds to step 214.

In an embodiment, smart intrusion program 136 updates context (step212). In other words, responsive to determining that the connectioncontext is new (decision step 210, YES branch), smart intrusion program136 updates the connection content in a dynamic event table. Accordingto embodiments of the present invention, connection contexts may includethe type of protocol used in the connection between two computingdevices (e.g., TCP, UDP (user datagram protocol), ICMP (Internet controlmessage protocol), SNMP (simple network management protocol), HTTPS(hypertext transfer protocol secure), and the like); the OS (operatingsystem) type and version; the service and version; and the application(e.g., a social media website, an e-mail service, an Internet shoppingportal, and the like). In an embodiment, smart intrusion program 136updates the context in a dynamic event table stored to repository 132 onclient device 130. For example, as depicted in FIG. 3B of dynamic eventtable 300, the connection context is updated to “openssl 1.0.1e” fromthe previous connection context “TCP”.

In an embodiment, smart intrusion program 136 calculates scores (step214). In other words, smart intrusion program 136 calculates the scorefor each IPS event in the dynamic event table based on the currentconnection context. In an embodiment, the score is based on theconnection context (i.e., if a contexts is “openssl”, then ssl-relatedIPS events will have a higher priority than non-ssl-related events or ifthe context is an application which runs in a particular OS, IPS eventsrelated to that particular OS will have a higher score than IPS eventsrelated to any other OS). In another embodiment, the score is calculatedbased on past historical data stored to a repository. In yet anotherembodiment, the score is calculated based on an algorithm such as theMaximum Likelihood Estimate (MLE), the least absolute shrinkage andselection operator (LASSO), the ElasticNet (EN) and the like. In anembodiment, MLE is a method of estimating the parameters of astatistical model given data. In an embodiment, LASSO is a regressionanalysis method that performs both variable selection and regularizationin order to enhance the prediction accuracy and interpretability of thestatistical model it produces. In an embodiment, EN, in the fitting oflinear or logistic regression models, is a regularized regression methodthat linearly combines penalties of the lasso method. In an embodiment,smart intrusion program 136 calculates the score for each IPS eventbased on past historical data stored to repository 132 on client device130. For example, as depicted in FIG. 3B of dynamic event table 300, thenew connection context results in the following changes to the scoresfor each IPS event: the score for IPS event “1” changes from “50” to“0”, the score for IPS event “2” changes from “50” to “80”, and thescore for IPS event 3 changes from “50” to “70”.

In an embodiment, smart intrusion program 136 prioritizes events (step216). In other words, smart intrusion program 136 prioritizes each IPSevent based on the calculated score of each IPS event. In an embodiment,the IPS event with the highest score is given the highest priority; theIPS event with the second highest score is given the second highestpriority, and so on, until all of the IPS events are prioritized. In anembodiment, in the case where two or more IPS events have the same score(e.g., IPS event “X” and IPS event “Y” both have a score of “25”), thetwo or more IPS events have the same priority (e.g., both IPS event “X”and IPS event “Y” have a priority of “5”). In another embodiment, an IPSevent with a score of “0” is not monitored unless the score changes to avalue other than “0”. In an embodiment, smart intrusion program 136prioritizes the IPS events in a dynamic event table stored to repository132 based on the calculated scores for each of the IPS events. Forexample, as depicted in FIG. 3B of dynamic event table 300, IPS event“2” is given a priority of one based on the score of “80”, IPS event “3”is given a priority of two based on a score of “70”, and IPS event “1”is given a priority of three based on a score of “0”.

In an embodiment, smart intrusion program 136 performs a signature check(step 218). In other words, smart intrusion program 136 performs asignature check of each IPS event with a score greater than “0” in thedynamic event table starting with the IPS event with the highestpriority. In an embodiment, the signature check uses deep packetinspection to compare the signature of the information in the receiveddata packet with the signatures of known malicious activities to detectincoming malicious activity. In an embodiment, smart intrusion program136 compares the signature of the received data packet with the knownsignatures of malicious activity stored to repository 132 on clientdevice 130. For example, as depicted in FIG. 3C of dynamic event table300, the signatures of the data packets for IPS event “1”, IPS event“2”, and IPS event “3” are compared with the signatures of knownmalicious activities.

In an embodiment, smart intrusion program 136 determines whether asignature was found (decision step 220). In other words, smart intrusionprogram 136 determines whether the signature check performed in step 218found any signatures in the received data packet that matched thesignatures of known malicious activities. In one embodiment (decisionstep 220, YES branch), one or more matching signatures were found;therefore, smart intrusion program 136 proceeds to step 222 to performone or more actions. In the embodiment (decision step 220, NO branch),no matching signatures were found; therefore, smart intrusion program136 returns to step 202 to wait for the receipt of additional datapackets.

In an embodiment, smart intrusion program 136 performs an action (step202). In other words, responsive to determining that one or morematching signatures were found (decision step 220, YES branch), smartintrusion program 136 performs one or more actions based on the matchedsignature. In an embodiment, the one or more actions include stoppingthe activity from proceeding when the activity is deemed malicious(i.e., finding matching signatures), discarding the activity (i.e., datapackets) when finding matching signatures, resetting the connectionand/or blocking the traffic from the offending IP (Internet protocol)address when finding matching signatures, and sending an alert whenmatching signatures are found which deem the activity malicious.

FIG. 4 depicts computer system 400, which is an example of a system thatincludes smart intrusion program 136. Computer system 400 includesprocessors 401, cache 403, memory 402, persistent storage 405,communications unit 407, input/output (I/O) interface(s) 406 andcommunications fabric 404. Communications fabric 404 providescommunications between cache 403, memory 402, persistent storage 405,communications unit 407, and input/output (I/O) interface(s) 406.Communications fabric 404 can be implemented with any architecturedesigned for passing data and/or control information between processors(such as microprocessors, communications and network processors, etc.),system memory, peripheral devices, and any other hardware componentswithin a system. For example, communications fabric 404 can beimplemented with one or more buses or a crossbar switch.

Memory 402 and persistent storage 405 are computer readable storagemedia. In this embodiment, memory 402 includes random access memory(RAM). In general, memory 402 can include any suitable volatile ornon-volatile computer readable storage media. Cache 403 is a fast memorythat enhances the performance of processors 401 by holding recentlyaccessed data, and data near recently accessed data, from memory 402.

Program instructions and data used to practice embodiments of thepresent invention may be stored in persistent storage 405 and in memory402 for execution by one or more of the respective processors 401 viacache 403. In an embodiment, persistent storage 405 includes a magnetichard disk drive. Alternatively, or in addition to a magnetic hard diskdrive, persistent storage 405 can include a solid state hard drive, asemiconductor storage device, read-only memory (ROM), erasableprogrammable read-only memory (EPROM), flash memory, or any othercomputer readable storage media that is capable of storing programinstructions or digital information.

The media used by persistent storage 405 may also be removable. Forexample, a removable hard drive may be used for persistent storage 405.Other examples include optical and magnetic disks, thumb drives, andsmart cards that are inserted into a drive for transfer onto anothercomputer readable storage medium that is also part of persistent storage405.

Communications unit 407, in these examples, provides for communicationswith other data processing systems or devices. In these examples,communications unit 407 includes one or more network interface cards.Communications unit 407 may provide communications through the use ofeither or both physical and wireless communications links. Programinstructions and data used to practice embodiments of the presentinvention may be downloaded to persistent storage 405 throughcommunications unit 407.

I/O interface(s) 406 allows for input and output of data with otherdevices that may be connected to each computer system. For example, I/Ointerface 406 may provide a connection to external devices 408 such as akeyboard, keypad, a touch screen, and/or some other suitable inputdevice. External devices 408 can also include portable computer readablestorage media such as, for example, thumb drives, portable optical ormagnetic disks, and memory cards. Software and data used to practiceembodiments of the present invention can be stored on such portablecomputer readable storage media and can be loaded onto persistentstorage 405 via I/O interface(s) 406. I/O interface(s) 406 also connectto display 409.

Display 409 provides a mechanism to display data to a user and may be,for example, a computer monitor.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk, C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The programs described herein are identified based upon the applicationfor which they are implemented in a specific embodiment of theinvention. However, it should be appreciated that any particular programnomenclature herein is used merely for convenience, and thus theinvention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

What is claimed is:
 1. A method for prioritizing intrusion events thatenhances the efficiency of signature matching of malicious activity, themethod comprising: responsive to determining that a new connectioncorresponding to a transmitted data packet is detected, adding, by oneor more computer processors, a connection context associated with thenew connection to a current connection context in a dynamic event table,wherein: the connection context is based on one or more of: an operatingsystem type associated with the connection, an operating system versionassociated with the connection, and an application responsible forsending the data packet associated with the connection, and the dynamicevent table includes the current connection context, one or moreprevious connection contexts, and a listing of two or more events,wherein each event of the two or more events is a malicious activity andis associated with a respective data packet; calculating, by one or morecomputer processors, a score for each event of two or more events in thedynamic event table based on the current connection context; performing,by one or more computer processors, a signature check of each eventhaving a score greater than or equal to a threshold value among the twoor more events according to a prioritized order based on the calculatedscore; and responsive to determining that a signature was found for anevent among the two or more events, preventing, by one or more computerprocessors, intrusion of the data packet associated with the event. 2.The method of claim 1, wherein the score for each event of the one ormore events in the dynamic event table is the score based on theconnection context; and the connection context includes a type ofprotocol used in the connection between two computing devices, anoperating system type, the operating system version, and theapplication.
 3. The method of claim 1, wherein the step of performing,by one or more computer processors, a signature check of each eventhaving a score greater than or equal to a threshold value among the twoor more events according to a prioritized order based on the calculatedscore, comprises: performing, by one or more computer processors, a deeppacket inspection to compare one or more signatures in the received datapacket to one or more signatures of known malicious activity.
 4. Themethod of claim 1, wherein responsive to determining that a signaturewas found for an event among the two or more events, preventing, by oneor more computer processors, intrusion of the data packet associatedwith the event is selected from the group consisting of stopping anactivity from proceeding when the activity is deemed malicious,discarding the activity when finding matching signatures, resetting theconnection and/or blocking traffic from an offending Internet protocoladdress when finding matching signatures, and sending an alert whenmatching signatures are found which deem the activity malicious.
 5. Themethod of claim 1, wherein responsive to determining that a signaturewas found for an event among the two or more events, preventing, by oneor more computer processors, intrusion of the data packet associatedwith the event consists: stopping an activity from proceeding when theactivity is deemed malicious, discarding the activity when findingmatching signatures, resetting the connection, blocking traffic from anoffending Internet protocol address when finding matching signatures,and sending an alert when matching signatures are found which deem theactivity malicious.
 6. A computer program product for prioritizingintrusion events that enhances the efficiency of signature matching ofmalicious activity, the computer program product comprising: one or morecomputer readable storage media; and program instructions stored on theone or more computer readable storage media, the program instructionscomprising: responsive to determining that a new connectioncorresponding to a transmitted data packet is detected, programinstructions to add a connection context associated with the newconnection to a current connection context in a dynamic event table,wherein: the connection context is based on one or more of: an operatingsystem type associated with the connection, an operating system versionassociated with the connection, and an application responsible forsending the data packet associated with the connection, and the dynamicevent table includes the current connection context, one or moreprevious connection contexts, and a listing of two or more events,wherein each event of the two or more events is a malicious activity andis associated with a respective data packet; program instructions tocalculate a score for each event of two or more events in the dynamicevent table based on the current connection context; programinstructions to perform a signature check of each event having a scoregreater than or equal to a threshold value among the two or more eventsaccording to a prioritized order based on the calculated score; andresponsive to determining that a signature was found for an event amongthe two or more events, program instructions to prevent intrusion of thedata packet associated with the event.
 7. The computer program productof claim 6, wherein the score for each event of the one or more eventsin the dynamic event table is the score based on the connection context;and the connection context includes a type of protocol used in theconnection between two computing devices, an operating system type, theoperating system version, and the application.
 8. The computer programproduct of claim 6, wherein the program instructions to perform asignature check of each event having a score greater than or equal to athreshold value among the two or more events according to a prioritizedorder based on the calculated score, comprises: program instructions toperform a deep packet inspection to compare one or more signatures inthe received data packet to one or more signatures of known maliciousactivity.
 9. The computer program product of claim 6, wherein responsiveto determining that a signature was found for an event among the two ormore events, program instructions to prevent intrusion of the datapacket associated with the event is selected from the group consistingof program instructions to stop an activity from proceeding when theactivity is deemed malicious, program instructions to discard theactivity when finding matching signatures, program instructions to resetthe connection, program instructions to block traffic from an offendingInternet protocol address when finding matching signatures, and programinstructions to send an alert when matching signatures are found whichdeem the activity malicious.
 10. The computer program product of claim6, wherein responsive to determining that a signature was found for anevent among the two or more events, program instructions to preventintrusion of the data packet associated with the event consists: programinstructions to stop an activity from proceeding when the activity isdeemed malicious, program instructions to discard the activity whenfinding matching signatures, program instructions to reset theconnection, program instructions to block traffic from an offendingInternet protocol address when finding matching signatures, and programinstructions to send an alert when matching signatures are found whichdeem the activity malicious.
 11. A computer system for prioritizingintrusion events that enhances the efficiency of signature matching ofmalicious activity, the computer system comprising: one or more computerprocessors; one or more computer readable storage media; and programinstructions stored on the one or more computer readable storage mediafor execution by at least one of the one or more computer processors,the program instructions comprising: responsive to determining that anew connection corresponding to a transmitted data packet is detected,program instructions to add a connection context associated with the newconnection to a current connection context in a dynamic event table,wherein: the connection context is based on one or more of: an operatingsystem type associated with the connection, an operating system versionassociated with the connection, and an application responsible forsending the data packet associated with the connection, and the dynamicevent table includes the current connection context, one or moreprevious connection contexts, and a listing of two or more events,wherein each event of the two or more events is a malicious activity andis associated with a respective data packet; program instructions tocalculate a score for each event of two or more events in the dynamicevent table based on the current connection context; programinstructions to perform a signature check of each event having a scoregreater than or equal to a threshold value among the two or more eventsaccording to a prioritized order based on the calculated score; andresponsive to determining that a signature was found for an event amongthe two or more events, program instructions to prevent intrusion of thedata packet associated with the event.
 12. The computer system of claim11, wherein the score for each event of the one or more events in thedynamic event table is the score based on the connection context; andthe connection context includes a type of protocol used in theconnection between two computing devices, an operating system type, theoperating system version, and the application.
 13. The computer systemof claim 11, wherein responsive to determining that a signature wasfound for an event among the two or more events, program instructions toprevent intrusion of the data packet associated with the event isselected from the group consisting of program instructions to stop anactivity from proceeding when the activity is deemed malicious, programinstructions to discard the activity when finding matching signatures,program instructions to reset the connection, program instructions toblock traffic from an offending Internet protocol address when findingmatching signatures, and program instructions to send an alert whenmatching signatures are found which deem the activity malicious.
 14. Thecomputer system of claim 11, wherein responsive to determining that asignature was found for an event among the two or more events, programinstructions to prevent intrusion of the data packet associated with theevent consists: program instructions to stop an activity from proceedingwhen the activity is deemed malicious, program instructions to discardthe activity when finding matching signatures, program instructions toreset the connection, program instructions to block traffic from anoffending Internet protocol address when finding matching signatures,and program instructions to send an alert when matching signatures arefound which deem the activity malicious.
 15. The computer system ofclaim 11, wherein the program instructions to perform a signature checkof each event having a score greater than or equal to a threshold valueamong the two or more events according to a prioritized order based onthe calculated score, comprises: program instructions to perform a deeppacket inspection to compare one or more signatures in the received datapacket to one or more signatures of known malicious activity.